1cmake_minimum_required(VERSION 3.9) 2 3set(CMAKE_VERBOSE_MAKEFILE ON) 4set(CMAKE_EXPORT_COMPILE_COMMANDS ON) 5set(CMAKE_POSITION_INDEPENDENT_CODE ON) 6 7project(FlatBuffersFuzzerTests) 8 9option(BUILD_DEBUGGER "Compile a debugger with main() and without libFuzzer" OFF) 10 11if(NOT DEFINED FLATBUFFERS_MAX_PARSING_DEPTH) 12 # Force checking of RecursionError in the test 13 set(FLATBUFFERS_MAX_PARSING_DEPTH 24) 14endif() 15message(STATUS "FLATBUFFERS_MAX_PARSING_DEPTH: ${FLATBUFFERS_MAX_PARSING_DEPTH}") 16 17# Usage '-fsanitize=address' doesn't allowed with '-fsanitize=memory'. 18# MemorySanitizer will not work out-of-the-box, and will instead report false 19# positives coming from uninstrumented code. Need to re-build both C++ standard 20# library: https://github.com/google/sanitizers/wiki/MemorySanitizerLibcxxHowTo 21option(USE_ASAN "Use fuzzers with ASASN" OFF) 22option(USE_MSAN "Use fuzzers with MSASN" OFF) 23option(OSS_FUZZ "Set this option to use flags by oss-fuzz" OFF) 24 25# Use Clang linker. 26set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fuse-ld=lld") 27 28# add_link_options(-stdlib=libc++) 29 30add_compile_options( 31 # -stdlib=libc++ # Use Clang libc++ instead of GNU. 32 -std=c++17 33 -Wall 34 -pedantic 35 -Werror 36 -Wextra 37 -Wno-unused-parameter 38 -fsigned-char 39 -fno-omit-frame-pointer 40 -g # Generate source-level debug information 41 # -flto # enable link-time optimisation 42) 43 44# https://llvm.org/docs/Passes.html save IR to see call graph make one bitcode 45# file:> llvm-link *.bc -o out.bc print call-graph:> opt out.bc -analyze -print- 46# callgraph &> callgraph.txt set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -save-temps 47# -flto") 48 49# A special target with fuzzer+sanitizer flags. 50add_library(fuzzer_config INTERFACE) 51 52target_compile_options( 53 fuzzer_config 54 INTERFACE 55 $<$<NOT:$<BOOL:${OSS_FUZZ}>>: 56 -fsanitize-coverage=trace-cmp 57 > 58 $<$<BOOL:${USE_ASAN}>: 59 -fsanitize=fuzzer,undefined,address 60 > 61 $<$<BOOL:${USE_MSAN}>: 62 -fsanitize=fuzzer,undefined,memory 63 -fsanitize-memory-track-origins=2 64 > 65 $<$<BOOL:${OSS_FUZZ}>: 66 ${CXX} 67 ${CXXFLAGS} 68 > 69) 70 71target_link_libraries( 72 fuzzer_config 73 INTERFACE 74 $<$<BOOL:${USE_ASAN}>: 75 -fsanitize=fuzzer,undefined,address 76 > 77 $<$<BOOL:${USE_MSAN}>: 78 -fsanitize=fuzzer,undefined,memory 79 > 80 $<$<BOOL:${OSS_FUZZ}>: 81 $ENV{LIB_FUZZING_ENGINE} 82 > 83) 84 85set(FLATBUFFERS_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../") 86 87set(FlatBuffers_Library_SRCS 88 ${FLATBUFFERS_DIR}/include/flatbuffers/allocator.h 89 ${FLATBUFFERS_DIR}/include/flatbuffers/array.h 90 ${FLATBUFFERS_DIR}/include/flatbuffers/base.h 91 ${FLATBUFFERS_DIR}/include/flatbuffers/buffer.h 92 ${FLATBUFFERS_DIR}/include/flatbuffers/buffer_ref.h 93 ${FLATBUFFERS_DIR}/include/flatbuffers/default_allocator.h 94 ${FLATBUFFERS_DIR}/include/flatbuffers/detached_buffer.h 95 ${FLATBUFFERS_DIR}/include/flatbuffers/flatbuffer_builder.h 96 ${FLATBUFFERS_DIR}/include/flatbuffers/flatbuffers.h 97 ${FLATBUFFERS_DIR}/include/flatbuffers/flexbuffers.h 98 ${FLATBUFFERS_DIR}/include/flatbuffers/flex_flat_util.h 99 ${FLATBUFFERS_DIR}/include/flatbuffers/hash.h 100 ${FLATBUFFERS_DIR}/include/flatbuffers/idl.h 101 ${FLATBUFFERS_DIR}/include/flatbuffers/minireflect.h 102 ${FLATBUFFERS_DIR}/include/flatbuffers/reflection.h 103 ${FLATBUFFERS_DIR}/include/flatbuffers/reflection_generated.h 104 ${FLATBUFFERS_DIR}/include/flatbuffers/registry.h 105 ${FLATBUFFERS_DIR}/include/flatbuffers/stl_emulation.h 106 ${FLATBUFFERS_DIR}/include/flatbuffers/string.h 107 ${FLATBUFFERS_DIR}/include/flatbuffers/struct.h 108 ${FLATBUFFERS_DIR}/include/flatbuffers/table.h 109 ${FLATBUFFERS_DIR}/include/flatbuffers/util.h 110 ${FLATBUFFERS_DIR}/include/flatbuffers/vector.h 111 ${FLATBUFFERS_DIR}/include/flatbuffers/vector_downward.h 112 ${FLATBUFFERS_DIR}/include/flatbuffers/verifier.h 113 ${FLATBUFFERS_DIR}/src/idl_parser.cpp 114 ${FLATBUFFERS_DIR}/src/idl_gen_text.cpp 115 ${FLATBUFFERS_DIR}/src/reflection.cpp 116 ${FLATBUFFERS_DIR}/src/binary_annotator.h 117 ${FLATBUFFERS_DIR}/src/binary_annotator.cpp 118 ${FLATBUFFERS_DIR}/src/util.cpp 119 ${FLATBUFFERS_DIR}/tests/test_assert.cpp 120 ${FLATBUFFERS_DIR}/tests/64bit/test_64bit_bfbs_generated.h 121) 122 123include_directories(${FLATBUFFERS_DIR}/include) 124include_directories(${FLATBUFFERS_DIR}/tests) 125include_directories(${FLATBUFFERS_DIR}/src) 126 127add_library(flatbuffers_fuzzed STATIC ${FlatBuffers_Library_SRCS}) 128# Use PUBLIC to force 'fuzzer_config' for all dependent targets 129target_link_libraries(flatbuffers_fuzzed PUBLIC fuzzer_config) 130 131# FLATBUFFERS_ASSERT should assert in Release as well. Redefine 132# FLATBUFFERS_ASSERT macro definition. Declare as PUBLIC to cover asserts in all 133# included header files. 134target_compile_definitions( 135 flatbuffers_fuzzed 136 PUBLIC 137 FLATBUFFERS_ASSERT=fuzzer_assert_impl 138 FLATBUFFERS_ASSERT_INCLUDE="${CMAKE_CURRENT_SOURCE_DIR}/fuzzer_assert.h" 139 PRIVATE 140 FLATBUFFERS_MAX_PARSING_DEPTH=${FLATBUFFERS_MAX_PARSING_DEPTH} 141) 142 143# Setup fuzzer tests. 144 145add_executable(scalar_fuzzer flatbuffers_scalar_fuzzer.cc) 146target_link_libraries(scalar_fuzzer PRIVATE flatbuffers_fuzzed) 147 148add_executable(parser_fuzzer flatbuffers_parser_fuzzer.cc) 149target_link_libraries(parser_fuzzer PRIVATE flatbuffers_fuzzed) 150 151add_executable(verifier_fuzzer flatbuffers_verifier_fuzzer.cc) 152target_link_libraries(verifier_fuzzer PRIVATE flatbuffers_fuzzed) 153 154add_executable(flexverifier_fuzzer flexbuffers_verifier_fuzzer.cc) 155target_link_libraries(flexverifier_fuzzer PRIVATE flatbuffers_fuzzed) 156 157add_executable(monster_fuzzer flatbuffers_monster_fuzzer.cc) 158target_link_libraries(monster_fuzzer PRIVATE flatbuffers_fuzzed) 159add_custom_command( 160 TARGET monster_fuzzer PRE_BUILD 161 COMMAND ${CMAKE_COMMAND} -E copy 162 ${CMAKE_SOURCE_DIR}/../monster_test.bfbs 163 ${CMAKE_CURRENT_BINARY_DIR}/monster_test.bfbs) 164 165add_executable(annotator_fuzzer flatbuffers_annotator_fuzzer.cc) 166target_link_libraries(annotator_fuzzer PRIVATE flatbuffers_fuzzed) 167add_custom_command( 168 TARGET annotator_fuzzer PRE_BUILD 169 170 COMMAND ${CMAKE_COMMAND} -E copy 171 ${CMAKE_SOURCE_DIR}/../annotated_binary/annotated_binary.bfbs 172 ${CMAKE_CURRENT_BINARY_DIR}/annotated_binary.bfbs 173 174 COMMAND ${CMAKE_COMMAND} -E copy 175 ${CMAKE_SOURCE_DIR}/../annotated_binary/annotated_binary.bin 176 ${CMAKE_CURRENT_BINARY_DIR}/seed_annotator/annotated_binary.bin 177) 178 179add_executable(64bit_fuzzer flatbuffers_64bit_fuzzer.cc) 180target_link_libraries(64bit_fuzzer PRIVATE flatbuffers_fuzzed) 181add_custom_command( 182 TARGET 64bit_fuzzer PRE_BUILD 183 184 COMMAND ${CMAKE_COMMAND} -E copy 185 ${CMAKE_SOURCE_DIR}/../64bit/test_64bit.bin 186 ${CMAKE_CURRENT_BINARY_DIR}/seed_64bit/test_64bit.bin 187) 188 189# Build debugger for weird cases found with fuzzer. 190if(BUILD_DEBUGGER) 191 add_library(flatbuffers_nonfuzz STATIC ${FlatBuffers_Library_SRCS}) 192 target_compile_options( 193 flatbuffers_nonfuzz 194 PUBLIC 195 $<$<BOOL:${USE_ASAN}>: 196 -fsanitize=undefined,address 197 > 198 -fno-limit-debug-info 199 ) 200 201 target_link_libraries( 202 flatbuffers_nonfuzz 203 PUBLIC 204 $<$<BOOL:${USE_ASAN}>: 205 -fsanitize=undefined,address 206 > 207 ) 208 209 target_compile_definitions( 210 flatbuffers_nonfuzz 211 PUBLIC 212 FLATBUFFERS_ASSERT=fuzzer_assert_impl 213 FLATBUFFERS_ASSERT_INCLUDE="${CMAKE_CURRENT_SOURCE_DIR}/fuzzer_assert.h" 214 PRIVATE 215 FLATBUFFERS_MAX_PARSING_DEPTH=${FLATBUFFERS_MAX_PARSING_DEPTH} 216 ) 217 add_executable(scalar_debug 218 flatbuffers_scalar_fuzzer.cc 219 scalar_debug.cpp 220 ) 221 target_link_libraries(scalar_debug PRIVATE flatbuffers_nonfuzz) 222 223 add_executable(monster_debug 224 flatbuffers_monster_fuzzer.cc 225 monster_debug.cpp 226 ) 227 target_link_libraries(monster_debug PRIVATE flatbuffers_nonfuzz) 228 add_custom_command( 229 TARGET monster_debug PRE_BUILD 230 COMMAND ${CMAKE_COMMAND} -E copy 231 ${CMAKE_SOURCE_DIR}/../monster_test.bfbs 232 ${CMAKE_CURRENT_BINARY_DIR}/monster_test.bfbs) 233 234endif(BUILD_DEBUGGER) 235